Bug 166597 - No way to set LDAP bind passwd without having it visible on the command line
Summary: No way to set LDAP bind passwd without having it visible on the command line
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: samba
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Jay Fenlason
QA Contact: David Lawrence
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-08-23 18:11 UTC by Mark McLoughlin
Modified: 2014-08-31 23:27 UTC (History)
1 user (show)

(edit)
Clone Of:
(edit)
Last Closed: 2007-01-02 08:22:17 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Mark McLoughlin 2005-08-23 18:11:14 UTC 
To set the LDAP bind passwd for samba (in secrets.tdb) you must use "smbpasswd
-w passwd"

It would be nice if smbpasswd would prompt for the password if it wasn't
supplied on the command line

Rationale is that for the brief time that smbpasswd is running, the password is
visible to everyone via /prov/$pid/cmdline, which isn't ideal
Comment 1 W. Michael Petullo 2005-12-24 15:27:31 UTC 
This is a security issue.  The smbpasswd program should support reading the 
admin password from a prompt, and also support the -s option (read from stdin.)
 Can the owner of this bug set the severity to secruity?
Comment 2 W. Michael Petullo 2005-12-24 17:21:37 UTC 
See also upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=3356.
Comment 3 W. Michael Petullo 2006-03-20 15:41:07 UTC 
I think this is now fixed in the upstream SVN tree.  See 
http://viewcvs.samba.org/cgi-bin/viewcvs.cgi?rev=13524&view=rev.
Comment 4 W. Michael Petullo 2006-12-30 18:17:24 UTC 
It looks like Fedora has incorporated the upstream fix.  I'm not sure exactly
when this was pulled in, but samba-common-3.0.23c-2 is good (see the new -W and
-s options.)  I tried to close this bug, but I can't because I was not the reporter.
Comment 5 Mark McLoughlin 2007-01-02 08:22:17 UTC 
Thanks, confirmed
Note You need to log in before you can comment on or make changes to this bug.